And the last video we talked about network profiling and other method of profiling is server profiling
server profiling information consists of things like what ports the servers is listening I'm logged
in users running processes and tasks as well as applications.
By tracking this type of information a contextual view of network hosts would be available for Incident
Response investigations and anomaly detection.
Let's hop in the lab and we'll go through how to identify this profiling information on Microsoft and
Linux servers.
All right so here I am on a Microsoft Windows Server.
First I'll show you the listening ports on the server so if you go to Star and then either search for
a command prompt or just pick it from the shortcuts here.
OK so the command we're going to run is not stat.
And then we'll do Dash 8.
So before I hit enter here I know there is going to be a long list of listening ports.
So I'm going to first increase my buffer size for my window so that I can scroll all the way to the
top so you can see everything.
So right click on the window go to properties.
Lay out
and then hit enter.
And I should be able to go back to the top So here you can see all the listening ports we have port
80 for TTP 88 for Kerberos 8:57 for Al Dabb and so on.
Skeer all map.
So as you can see it's a really easy way just to understand what parts are being listened on on your
servers.
So a good thing to do for any server environment would be to have some documentation on what ports are
being listened time on each of your servers and and make sure to block any ports that you don't want
the server to be listening on in the Windows firewall.
OK so next we can actually find with the rest of the profiling information we were looking for by simply
going to the task manager.
So I'll just go blow the taskbar here right click somewhere and then click.
Task Manager.
So as you can see here we have our applications that are running on the server processes services as
well as the logged in users.
So this shows that there is an administrator user logged in which is me via an RTP session so that does
it for Windows.
But now let's jump over to a Linux server to find the same information.
All right so here I am on my Linux server I'm going to go to the terminal and we'll start off by looking
for listening ports.
You can actually use the stack command just like we did in Windows except there are some different options.
So I'm going to add the listening ports and the flags for UDP as well.
TCAP and it looks like the only listening port on the server is UDP 68 for DHP to identify users logged
into a Linux machine you can run the w command.
And as I expected the only user logged in to this Linux box as myself as the root user
next to see the running processes on a Linux server you can run the command top.
And as you can see you can see the process ID information users tied to each process as well as CPQ
and memory usage and then to check all the running applications on the server I can use the command
P.S. dash
and there I have my documentation on my applications running on the system.